CVE-2026-119658 in PowerDNS-Admin
Summary
by MITRE • 10/30/2026
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in PowerDNS-Admin versions up to 2026.08.1 represents a critical authorization bypass flaw within the application's API layer, specifically affecting the mechanism for refreshing secondary DNS zones. This issue stems from an insufficient validation of access control policies when processing requests that modify or interact with domain resources. While the system correctly enforces permissions during initial authentication and basic resource listing, it fails to re-validate ownership or administrative rights at the point where a user attempts to trigger a zone refresh operation. By manipulating the JSON payload sent in the request body, an attacker can substitute the 'domain' field with identifiers belonging to secondary zones that are not associated with their own account but are managed by other users within the same PowerDNS-Admin instance. This discrepancy between the authenticated context and the requested resource identifier allows unauthorized actors to execute administrative actions on resources they do not possess or manage, effectively circumventing the intended role-based access controls designed to isolate user data and operational boundaries.
From a technical perspective, this flaw is classified under CWE-284 Improper Access Control, as it involves a failure by the software to correctly enforce security policies regarding who can perform specific actions on which resources. The vulnerability leverages the fact that many web applications rely heavily on client-supplied identifiers for resource targeting without performing server-side verification against the authenticated user's permission set. In this case, when an attacker with any valid User-role account submits a request to refresh a secondary zone, they include the domain name of another user's zone in the JSON body rather than their own. The backend logic processes this identifier and initiates the corresponding action without cross-referencing it against the current session's authorized domains list. This lack of server-side authorization checks at the operation level creates a direct path for privilege escalation relative to resource access, allowing lower-privileged users to interact with high-value infrastructure components that should remain strictly private or restricted to their respective administrators.
The operational impact of this vulnerability is significant due to its potential to facilitate broader reconnaissance and data exfiltration through DNS zone transfers. An attacker can exploit this flaw to force the PowerDNS system to perform AXFR (zone transfer) operations for secondary zones belonging to other users. By observing the HTTP response codes, timing differences, or error messages returned by the API after attempting these unauthorized refreshes, an adversary can infer whether specific domains exist within the organization's DNS infrastructure even if those domains are not visible in their own dashboard. This capability effectively turns PowerDNS-Admin into a tool for network reconnaissance, allowing attackers to map out internal and external domain structures that should be hidden from them. Furthermore, successful exploitation could lead to the exposure of sensitive DNS records containing IP addresses, mail server configurations, or other infrastructure details if the refresh operation triggers any logging or notification mechanisms that leak information back to the requester. This aligns with ATT&CK techniques such as T1087 Account Discovery and potentially T1496 Remote Service Scanning, depending on how the inferred data is utilized in subsequent attack phases.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to apply the vendor-provided patch that updates PowerDNS-Admin to a version beyond 2026.08.1, where this authorization logic has been corrected to validate domain ownership before executing zone refresh operations. For environments where immediate patching is not feasible due to operational constraints, network-level controls can be implemented as compensating measures. This includes restricting API access through strict IP whitelisting or implementing a Web Application Firewall (WAF) rule set that monitors for anomalous patterns in JSON payloads, such as requests targeting domain identifiers inconsistent with the user's known profile data. Additionally, administrators should audit existing logs to determine if any unauthorized zone refresh attempts have occurred and rotate credentials for all affected accounts to ensure no session tokens were compromised during potential exploitation events. Future development cycles must prioritize implementing robust server-side authorization checks that verify resource ownership against every authenticated request, ensuring that access control decisions are never delegated solely to client-supplied data fields without rigorous validation.